Just some random thoughts on NetBurst (not related to P6 - see en.wikipedia.org/wiki/NetBurst↗ ), mostly speculative garbage not worth reading, however INTJs may find this page exciting ;).

Some thoughts

(based on observations below)

• last 32 bits might be checksum
• we do not know where platform mask and CPUID is stored in the patch; if it's in first 12 bytes, then the cipher is probably using xor on keystream, otherwise all bits in 0xBD except 1<<3 (8) would be "DO NOT CARE" in some byte and there is no such byte there. This can be verified on a CPU where multiple platform-dependent patches exist.
• looks like patch is loaded into relevant CPU parts as it is being loaded, expected checksum only fires some "patch enable" bit
• first 12 bytes (0x30-0x3B)
• do some crazy magic
• have some do not care bits
• are probably not covered by checksum
• guess: nonce/iv in the first dword (0x30-0x33)- because modification there leads to really weird rdtsc differences (-> weirdly decrypted lengths in 0x38-0x3B)
• guess: some flags in the second dword (0x34-0x37)
• guess: 8bit lengths/field counts in the third dword (0x38-0x3B); can be probably verified using moving patch near invalid page ;)
• there must be patch length (e.g. CPUID F34 plat 1D has 2 version with different size!); 0x38 is good candidate due to bitflip timing differences.
• some patches in plaintext-like 2 dwords in early netburst may mean weak cipher
• At least based on byte 0x38 it seems there is no bit permutation/scrambling performed.
• rdtsc timing seems to be:
• 0000000000117820-0000000000117860: checksum failure
• 00000000001179D5-0000000000117A00: patch loaded OK
• anything else: ????

F49 - byte 0x38 analysis

Expected field count / size with biggest time difference:

0038.0,0000000000110F97
0038.1,0000000000124AF1
0038.2,0000000000131C0E
0038.3,000000000014BF05
0038.4,0000000000180451
0038.5,000000000004612F
0038.6,00000000002BA799
0038.7,000000000045D6DA

if only bit 5 is set (plaintext value 0x20, ciphertext 0xE4), zero count/size gives us base rdtscdiff=4612F, so differences:

0038.0, 0000000000110F97-4612F=0CAE68
0038.1, 0000000000124AF1-4612F=0DE9C2
0038.2, 0000000000131C0E-4612F=0EBADF
0038.3, 000000000014BF05-4612F=105DD6
0038.4, 0000000000180451-4612F=13A322
0038.5, 000000000004612F-4612F=000000
0038.6, 00000000002BA799-4612F=27466A
0038.7, 000000000045D6DA-4612F=4175AB

monotonic = Looks like no bit permutation/scrambling performed.

Data @0x30:

AB A5 97 1D 45 5B D4 D8 E4 EE DE 89 D7 56 C9 DB  ciphertext
__ __ __ __ __ __ __ __ 20 __ __ __ __ __ __ __  plaintext
__ __ __ __ __ __ __ __ C4 __ __ __ __ __ __ __  xor-keystream?

Weird patches

All these start with e9 ff ff ff | 5e 00 00 00 @0x30:

cpu00F27_plat02_ver00000028_2002-07-22_PRD_F0564209.bin
cpu00F27_plat02_ver00000034_2002-11-06_PRD_1E25ABF5.bin
cpu00F27_plat02_ver00000038_2003-06-04_PRD_6D330D4A.bin
cpu00F27_plat04_ver00000027_2002-07-22_PRD_FAD3605D.bin
cpu00F27_plat04_ver00000033_2002-11-06_PRD_3D579E37.bin
cpu00F27_plat04_ver00000037_2003-06-04_PRD_972CD5FA.bin
cpu00F27_plat08_ver00000029_2002-07-22_PRD_04884B02.bin
cpu00F27_plat08_ver00000035_2002-11-06_PRD_2C674E26.bin
cpu00F27_plat08_ver00000039_2003-06-04_PRD_823432CA.bin

(and continue with a6 52 f9 96 02 8f 36 aa or f6 07 f9 96 02 8f 36 aa)

Some other continue with second dword (instead of 5e 00 00 00) with 1a e6 e0 80, 21 f1 15 57, 2b ae 01 50,4a 60 3a 9b, 63 62 b3 e6 or 66 68 b6 8b).

Changes in bytes 30-3B (incl.) give weird rdtsc wrmsr timing.

F49 - rdtsc patch load timing

Load on F49 plat 03 (patch cpu00F49_platBD_ver00000003_2005-04-21_PRD_F85D53B8.bin). Log references changed byte.bit position in file and rdtsc timing difference for wrmsr. All timing seems to be consistent (minor differences only after filtering out interrupts/SMM/etc.) on multiple runs.

Initial block gives weird timing:

0030.0,00000000001154B9
0030.1,00000000000AAB95
0030.2,00000000001154CC
0030.3,00000000001154CC
0030.4,00000000001154CC
0030.5,00000000003E1262
0030.6,00000000002BA790
0030.7,0000000000172E0D

0031.0,0000000000118B62
0031.1,0000000000394D56
0031.2,000000000011C102
0031.3,000000000048844D
0031.4,0000000000118B3D
0031.5,0000000000119D16
0031.6,000000000011C0BF
0031.7,00000000001154DF

0032.0,00000000000FB82D
0032.1,0000000000119CC1
0032.2,00000000001154C3
0032.3,000000000049ED43
0032.4,0000000000113035
0032.5,000000000010E636
0032.6,00000000001053AB
0032.7,000000000013C6DF

0033.0,0000000000119D32
0033.1,00000000001132B1
0033.2,00000000004A23A0
0033.3,00000000003600CD
0033.4,000000000013B618
0033.5,000000000025CB02
0033.6,00000000001154B0
0033.7,0000000000235FBA

0034.0,0000000000282B28
0034.1,00000000001179DE Load OK - do not care?
0034.2,00000000003F99FF
0034.3,00000000003EBD7F
0034.4,000000000013E6EE
0034.5,00000000001179DE Load OK - do not care?
0034.6,00000000001179DF Load OK - do not care?
0034.7,00000000001154E8

0035.0,00000000001B8884
0035.1,00000000001179DE Load OK - do not care?
0035.2,00000000003B5C79
0035.3,000000000014E29B
0035.4,00000000001179DE Load OK - do not care?
0035.5,00000000001E67D7
0035.6,00000000002ECF23
0035.7,00000000001179E8 Load OK - do not care?

0036.0,00000000004EA335
0036.1,00000000001179DF Load OK - do not care?
0036.2,00000000001179FB Load OK - do not care?
0036.3,00000000003F78B6
0036.4,000000000021FAD8
0036.5,00000000001179DF Load OK - do not care?
0036.6,00000000002E4FED
0036.7,00000000001179F1 Load OK - do not care?

0037.0,00000000004E1B9C
0037.1,00000000001179D5 Load OK - do not care?
0037.2,00000000001179F2 Load OK - do not care?
0037.3,00000000001179E8 Load OK - do not care?
0037.4,00000000001179E8 Load OK - do not care?
0037.5,00000000001179E8 Load OK - do not care?
0037.6,00000000001154E9
0037.7,00000000001179FB Load OK - do not care?

0038.0,0000000000110F97 might be some length or field count??
0038.1,0000000000124AF1
0038.2,0000000000131C0E
0038.3,000000000014BF05
0038.4,0000000000180451
0038.5,000000000004612F  -- looks like this bit got flipped from 1->0 and result is now much smaller!
0038.6,00000000002BA799
0038.7,000000000045D6DA

0039.0,0000000000118B29
0039.1,0000000000119CF9
0039.2,000000000011C0B6
0039.3,000000000012085E
0039.4,0000000000118B16
0039.5,0000000000119CF9
0039.6,000000000011C0B6
0039.7,0000000000120855

003A.0,0000000000118A29
003A.1,0000000000119C91
003A.2,0000000000118BCB
003A.3,0000000000115359
003A.4,0000000000112E21
003A.5,000000000010E40F
003A.6,0000000000105170
003A.7,000000000013C6B8

003B.0,0000000000119D1F
003B.1,00000000001130A7
003B.2,0000000000120884
003B.3,00000000001059E7
003B.4,000000000013B5F3
003B.5,000000000015F29E
003B.6,00000000001A6BE3
003B.7,0000000000235F48

Since this block, change in any bit (with exception below) gives roughly same timing in range 0000000000117820 to 0000000000117860 (likely failing some check).

Changes in this block give consistently timing which equals to loading original file - looks like these bytes are "DO NOT CARE":

07F8.0,0000000000117A18
07F8.1,00000000001179D5
07F8.2,0000000000117A0E
07F8.3,00000000001179D5
07F8.4,00000000001179D5
07F8.5,00000000001179D5
07F8.6,00000000001179E8
07F8.7,00000000001179DE
07F9.0,00000000001179DF
07F9.1,00000000001179D5
07F9.2,00000000001179DF
07F9.3,00000000001179DE
07F9.4,00000000001179D5
07F9.5,00000000001179D5
07F9.6,00000000001179D5
07F9.7,00000000001179DF
07FA.0,00000000001179D5
07FA.1,00000000001179DE
07FA.2,00000000001179DE
07FA.3,00000000001179DE
07FA.4,00000000001179DF
07FA.5,00000000001179D5
07FA.6,00000000001179D5
07FA.7,00000000001179DE
07FB.0,00000000001179D5
07FB.1,00000000001179D5
07FB.2,00000000001179DE
07FB.3,00000000001179DE
07FB.4,00000000001179DE
07FB.5,00000000001179D5
07FB.6,00000000001179DF
07FB.7,00000000001179D5

Bytes 7FC-7FF again give slightly shorter timing like change in the large block between 03C-07F7 (maybe a checksum?? CRC??).

Loading patches for different cpuid results in this timing:

cpu00F00_plat01_verFFFF0001_2000-01-30_PRE_3675924F.bin tscdiff=000000000032AFE3
cpu00F01_plat01_verFFFF0004_2000-02-29_PRE_18059A2B.bin tscdiff=00000000002274DD
cpu00F01_plat01_verFFFF0007_2000-04-04_PRE_E0C5C6F8.bin tscdiff=0000000000361941
cpu00F02_plat01_verFFFF000B_2000-05-18_PRE_456218D2.bin tscdiff=00000000001154C2
cpu00F03_plat01_verFFFF0001_2000-05-18_PRE_3594D265.bin tscdiff=0000000000469B59
cpu00F04_plat01_verFFFF000A_2000-07-18_PRE_C5F9EAA6.bin tscdiff=00000000001154C2
cpu00F04_plat02_verFFFF000B_2000-07-18_PRE_3342165B.bin tscdiff=00000000001154C2
cpu00F05_plat01_ver00000007_2000-08-03_PRD_F137420A.bin tscdiff=00000000001154C2
cpu00F05_plat01_ver0000000B_2000-08-24_PRD_50C99636.bin tscdiff=00000000001154C2
cpu00F05_plat02_ver00000008_2000-08-03_PRD_98F34C81.bin tscdiff=00000000001154C2
cpu00F05_plat02_ver0000000C_2000-08-24_PRD_EDB8177B.bin tscdiff=00000000001154C2
cpu00F06_plat02_ver00000004_2000-09-11_PRD_680047B7.bin tscdiff=000000000042F9B8
cpu00F07_plat01_ver00000003_2000-08-24_PRD_3628C649.bin tscdiff=00000000001154B9
cpu00F07_plat01_ver00000007_2000-11-15_PRD_D8F3A74B.bin tscdiff=00000000001154A6
cpu00F07_plat01_ver0000000D_2002-02-14_PRD_8E3176C3.bin tscdiff=00000000001154CC
cpu00F07_plat01_ver00000012_2002-07-16_PRD_39E69FF0.bin tscdiff=00000000001154B9
cpu00F07_plat02_ver00000004_2000-08-24_PRD_0E41B8C7.bin tscdiff=00000000001154C2
cpu00F07_plat02_ver00000008_2000-11-15_PRD_B7B473E7.bin tscdiff=00000000001154A6
cpu00F08_plat02_ver00000006_2000-10-26_PRD_F3613D01.bin tscdiff=00000000004E25C7
cpu00F08_plat02_ver00000008_2000-11-01_PRD_A8F18DDC.bin tscdiff=00000000004E257B
cpu00F09_plat02_ver00000008_2001-01-04_PRD_7EE4927C.bin tscdiff=00000000004B6512
cpu00F0A_plat01_ver00000005_2001-01-12_PRD_F816CC4F.bin tscdiff=000000000027886F
cpu00F0A_plat01_ver00000010_2002-01-11_PRD_C3A888B5.bin tscdiff=0000000000259DFE
cpu00F0A_plat01_ver00000013_2002-07-16_PRD_2A2CC3CB.bin tscdiff=000000000048C06A
cpu00F0A_plat02_ver00000006_2001-01-12_PRD_6DDE873C.bin tscdiff=000000000027886F
cpu00F0A_plat02_ver00000015_2002-08-21_PRD_63E49A0C.bin tscdiff=000000000048C057
cpu00F0A_plat04_ver00000009_2001-02-27_PRD_571FE45E.bin tscdiff=0000000000278865
cpu00F0A_plat04_ver00000012_2002-01-11_PRD_26CA4178.bin tscdiff=0000000000259DBC
cpu00F0A_plat04_ver00000014_2002-07-16_PRD_64731550.bin tscdiff=000000000048C044
cpu00F11_plat02_ver00000008_2002-07-16_PRD_0A9EA290.bin tscdiff=0000000000236266
cpu00F11_plat02_ver0000000A_2003-07-29_PRD_F72C94EC.bin tscdiff=0000000000236295
cpu00F12_plat01_ver00000026_2002-01-12_PRD_9608098D.bin tscdiff=0000000000263755
cpu00F12_plat01_ver0000002A_2002-07-16_PRD_3A66BEE8.bin tscdiff=00000000005673EB
cpu00F12_plat01_ver0000002D_2003-05-02_PRD_22BA6824.bin tscdiff=00000000005673EB
cpu00F12_plat02_ver0000002B_2002-07-16_PRD_6C25C9B7.bin tscdiff=0000000000567383
cpu00F12_plat02_ver0000002F_2003-05-02_PRD_44847ACC.bin tscdiff=0000000000567408
cpu00F12_plat04_ver00000003_2001-05-23_PRD_15DAE44F.bin tscdiff=0000000000263708
cpu00F12_plat04_ver00000028_2002-01-12_PRD_2F6967B9.bin tscdiff=000000000026372E
cpu00F12_plat04_ver0000002C_2002-07-16_PRD_22CA8EB8.bin tscdiff=0000000000567396
cpu00F12_plat04_ver0000002E_2003-05-02_PRD_B2548D0A.bin tscdiff=00000000005673EC
cpu00F13_plat04_ver00000003_2002-02-11_PRD_3793F1BB.bin tscdiff=00000000001154B9
cpu00F13_plat04_ver00000004_2002-07-17_PRD_B0C33AA0.bin tscdiff=00000000001154B9
cpu00F13_plat04_ver00000005_2003-05-08_PRD_386C53DA.bin tscdiff=00000000001154C2
cpu00F20_plat04_ver00000001_2001-04-23_PRD_80719695.bin tscdiff=00000000001154CC
cpu00F21_plat02_ver00000002_2001-05-29_PRD_0838C135.bin tscdiff=000000000057CCC7
cpu00F21_plat04_ver00000001_2001-05-29_PRD_78CDDD37.bin tscdiff=000000000057CCED
cpu00F21_plat08_ver00000003_2001-05-29_PRD_2488646C.bin tscdiff=000000000057CD0A
cpu00F22_plat02_ver00000003_2002-04-06_PRD_664EE8E8.bin tscdiff=00000000004F8B23
cpu00F22_plat02_ver00000005_2003-07-29_PRD_7190B462.bin tscdiff=00000000004F8B1A
cpu00F23_plat02_ver00000009_2001-07-30_PRD_AD94879E.bin tscdiff=000000000030A92C
cpu00F23_plat04_ver00000008_2001-07-30_PRD_7483278F.bin tscdiff=000000000030A919
cpu00F23_plat08_ver00000003_2001-07-07_PRD_CF8A6008.bin tscdiff=000000000030A935
cpu00F23_plat08_ver0000000D_2001-08-17_PRD_450D1064.bin tscdiff=000000000030A922
cpu00F24_plat02_ver00000010_2002-07-19_PRD_789BB8D7.bin tscdiff=00000000002A0A6D
cpu00F24_plat02_ver0000001D_2003-01-16_PRD_2EA67DC8.bin tscdiff=00000000002A0AB8
cpu00F24_plat02_ver0000001F_2003-06-05_PRD_1F19B59B.bin tscdiff=00000000002A0A89
cpu00F24_plat04_ver00000007_2001-10-26_PRD_39226540.bin tscdiff=00000000001154DF
cpu00F24_plat04_ver0000000B_2002-01-14_PRD_68298430.bin tscdiff=00000000001154A6
cpu00F24_plat04_ver0000000F_2002-07-19_PRD_9C1F59BD.bin tscdiff=00000000002A0AA5
cpu00F24_plat04_ver00000018_2002-11-07_PRD_BAAFD460.bin tscdiff=00000000002A0A93
cpu00F24_plat04_ver0000001E_2003-06-05_PRD_9BA58D71.bin tscdiff=00000000002A0AC2
cpu00F24_plat08_ver00000011_2002-07-19_PRD_B11A68FB.bin tscdiff=00000000002A0AB8
cpu00F24_plat08_ver0000001A_2002-11-11_PRD_734224E2.bin tscdiff=00000000002A0AD5
cpu00F24_plat08_ver00000020_2003-06-05_PRD_828598C7.bin tscdiff=00000000002A0A92
cpu00F24_plat10_ver00000013_2002-09-07_PRD_6ED8C0F9.bin tscdiff=00000000002A0ACB
cpu00F24_plat10_ver00000021_2003-06-10_PRD_83ED02E7.bin tscdiff=00000000002A0AAF
cpu00F25_plat01_ver00000011_2003-06-13_PRD_F213075B.bin tscdiff=00000000004AF77C
cpu00F25_plat01_ver00000029_2004-08-11_PRD_2795BA4B.bin tscdiff=00000000004AF743
cpu00F25_plat02_ver0000000E_2003-06-13_PRD_EC3344C1.bin tscdiff=00000000004AF756
cpu00F25_plat02_ver0000002A_2004-08-11_PRD_AD53035D.bin tscdiff=00000000004AF769
cpu00F25_plat04_ver00000005_2003-01-23_PRD_FD09B575.bin tscdiff=00000000004AF760
cpu00F25_plat04_ver00000015_2003-07-21_PRD_D6976E46.bin tscdiff=00000000004AF75F
cpu00F25_plat04_ver0000001B_2004-02-03_PRD_DCBE99DE.bin tscdiff=00000000004AF760
cpu00F25_plat04_ver0000001F_2004-04-06_PRD_8268CCFC.bin tscdiff=00000000004AF7A2
cpu00F25_plat04_ver0000002B_2004-08-11_PRD_E4DCCE66.bin tscdiff=00000000004AF756
cpu00F25_plat10_ver00000020_2004-04-06_PRD_7080BD1A.bin tscdiff=00000000004AF7A2
cpu00F25_plat10_ver0000002C_2004-08-26_PRD_62D062AB.bin tscdiff=00000000004AF743
cpu00F26_plat02_ver0000000D_2004-03-09_PRD_8E6FA00D.bin tscdiff=00000000001154CC
cpu00F26_plat02_ver00000010_2004-08-05_PRD_17CCAB58.bin tscdiff=00000000001154A6
cpu00F27_plat02_ver00000028_2002-07-22_PRD_F0564209.bin tscdiff=00000000001D99EB
cpu00F27_plat02_ver00000034_2002-11-06_PRD_1E25ABF5.bin tscdiff=00000000003F0828
cpu00F27_plat02_ver00000038_2003-06-04_PRD_6D330D4A.bin tscdiff=00000000003F07F9
cpu00F27_plat04_ver00000024_2002-06-28_PRD_D7490795.bin tscdiff=00000000004B0D28
cpu00F27_plat04_ver00000027_2002-07-22_PRD_FAD3605D.bin tscdiff=00000000001D9A08
cpu00F27_plat04_ver00000033_2002-11-06_PRD_3D579E37.bin tscdiff=00000000003F07F0
cpu00F27_plat04_ver00000037_2003-06-04_PRD_972CD5FA.bin tscdiff=00000000003F07D3
cpu00F27_plat08_ver00000029_2002-07-22_PRD_04884B02.bin tscdiff=00000000001D99FF
cpu00F27_plat08_ver00000035_2002-11-06_PRD_2C674E26.bin tscdiff=00000000003F080C
cpu00F27_plat08_ver00000039_2003-06-04_PRD_823432CA.bin tscdiff=00000000003F083B
cpu00F29_plat02_ver0000000F_2003-01-23_PRD_2DE12F00.bin tscdiff=00000000005972D2
cpu00F29_plat02_ver0000002D_2004-08-11_PRD_76E56915.bin tscdiff=00000000005972DC
cpu00F29_plat04_ver0000000E_2003-01-23_PRD_B021AF2A.bin tscdiff=00000000005972C9
cpu00F29_plat04_ver00000011_2003-04-14_PRD_E2A5CACA.bin tscdiff=00000000005972C9
cpu00F29_plat04_ver00000014_2003-06-04_PRD_B8B0831E.bin tscdiff=00000000005972E6
cpu00F29_plat04_ver00000017_2003-07-18_PRD_C42D13A3.bin tscdiff=00000000005972EF
cpu00F29_plat04_ver00000021_2004-03-24_PRD_DEEC05F1.bin tscdiff=00000000005972C9
cpu00F29_plat04_ver0000002E_2004-08-11_PRD_7695D4DC.bin tscdiff=00000000005972E6
cpu00F29_plat08_ver00000010_2003-01-23_PRD_E047344F.bin len=000007FF tscdiff=00000000005972EF
cpu00F29_plat08_ver00000019_2003-07-18_PRD_61A4686F.bin tscdiff=00000000005972AC
cpu00F29_plat08_ver0000002F_2004-08-11_PRD_FDB52A5D.bin tscdiff=00000000005972B6
cpu00F30_plat01_ver00000013_2003-08-15_PRD_C3DB4E87.bin len=00001000 tscdiff=00000000001154A6
cpu00F30_plat04_ver0000000C_2003-06-24_PRD_D520D8B1.bin len=00000C00 tscdiff=00000000004C9ADC
cpu00F30_plat04_ver00000012_2003-08-13_PRD_C683ADC5.bin len=00001000 tscdiff=00000000001154A6
cpu00F30_plat08_ver0000000E_2003-06-24_PRD_AE517ED6.bin len=00000C00 tscdiff=00000000004C9AB6
cpu00F31_plat0D_ver00000005_2003-08-20_PRD_58FE255C.bin len=00001000 tscdiff=0000000000203AF9
cpu00F31_plat0D_ver0000000B_2003-10-21_PRD_974050CD.bin len=00001000 tscdiff=00000000001F0DCB
cpu00F31_plat1D_ver00000001_2003-07-25_PRD_12710760.bin len=00001000 tscdiff=00000000001E5BAB
cpu00F32_plat0D_ver00000007_2003-11-03_PRD_86FC05C1.bin tscdiff=00000000005BD821
cpu00F32_plat0D_ver00000008_2003-11-14_PRD_7E325269.bin len=00001000 tscdiff=00000000001154DF
cpu00F32_plat0D_ver0000000A_2004-05-11_PRD_2538EF0A.bin tscdiff=00000000005B9354
cpu00F33_plat0D_ver00000007_2003-11-21_PRD_B78B30F0.bin tscdiff=00000000001154D6
cpu00F33_plat0D_ver0000000B_2004-05-12_PRD_E5668AEA.bin tscdiff=00000000001154D6
cpu00F33_plat0D_ver0000000C_2005-04-21_PRD_58C41EFD.bin tscdiff=00000000001154C2
cpu00F34_plat02_ver00000012_2004-06-30_PRD_E63383F0.bin len=00001C00 tscdiff=00000000004567D2
cpu00F34_plat1D_ver0000000C_2004-03-10_PRD_042B92B6.bin len=00001800 tscdiff=00000000004E7514
cpu00F34_plat1D_ver0000000E_2004-05-04_PRD_9B18561D.bin len=00001800 tscdiff=00000000004FD967
cpu00F34_plat1D_ver00000013_2004-07-30_PRD_95F183F0.bin len=00001800 tscdiff=000000000050440E
cpu00F34_plat1D_ver00000017_2005-04-21_PRD_2CBD6146.bin len=00001C00 tscdiff=000000000043B098
cpu00F34_plat8D_ver00000007_2003-11-10_PRD_F1AD5AF6.bin len=00000C00 tscdiff=00000000001154AF
cpu00F34_plat9D_ver00000008_2004-02-10_PRD_C658E346.bin len=00001400 tscdiff=000000000058A2AD
cpu00F36_plat02_ver00000007_2004-03-09_PRD_5E05D4BD.bin len=00001400 tscdiff=00000000001154CC
cpu00F37_plat01_ver00000003_2003-12-18_PRD_57CE5CBA.bin len=00001000 tscdiff=000000000029101F
cpu00F37_plat0D_ver00000002_2003-12-09_PRD_2B57BD9E.bin tscdiff=00000000002FF50B
cpu00F40_plat9D_ver00000006_2004-03-18_PRD_CC8CC6DD.bin len=00001400 tscdiff=00000000002D930A
cpu00F41_plat02_ver00000016_2005-04-21_PRD_0A12A70A.bin len=00001400 tscdiff=00000000004F2202
cpu00F41_plat9D_ver00000005_2004-05-20_PRD_CFF50393.bin len=00000C00 tscdiff=00000000005C0E16
cpu00F41_platBD_ver00000009_2004-08-02_PRD_5C400364.bin len=00001000 tscdiff=00000000004B6340
cpu00F41_platBD_ver00000017_2005-04-22_PRD_326135C1.bin len=00001400 tscdiff=00000000004DFF25
cpu00F42_plat9D_ver00000003_2005-04-21_PRD_7A20982B.bin len=00000C00 tscdiff=00000000003A0A5F
cpu00F43_plat9D_ver00000003_2004-08-17_PRD_CE258C8F.bin tscdiff=0000000000502C0C
cpu00F43_plat9D_ver00000004_2004-11-01_PRD_4E12682A.bin tscdiff=00000000004F5655
cpu00F43_plat9D_ver00000005_2005-04-21_PRD_77812C17.bin tscdiff=00000000004F5655
cpu00F44_plat9D_ver00000006_2005-04-21_PRD_9F60DB18.bin len=00000C00 tscdiff=00000000001154AF
cpu00F46_plat5D_ver00000004_2005-04-11_PRD_E0FC575F.bin len=00000C00 tscdiff=00000000005843DC
cpu00F47_plat9D_ver00000003_2005-04-21_PRD_AF2CEF0D.bin len=00000C00 tscdiff=00000000001154A6
cpu00F48_plat01_ver0000000C_2006-05-08_PRD_5B9AFEC7.bin len=00000C00 tscdiff=000000000052CD65
cpu00F48_plat02_ver0000000B_2005-09-01_PRD_090B64F2.bin len=00000C00 tscdiff=000000000053584B
cpu00F48_plat02_ver0000000E_2008-01-15_PRD_0E158E10.bin len=00000C00 tscdiff=000000000053584B
cpu00F48_plat5F_ver00000007_2005-06-30_PRD_D0938263.bin len=00000C00 tscdiff=000000000052CCF3
cpu00F49_platBD_ver00000003_2005-04-21_PRD_F85D53B8.bin tscdiff=00000000001179DE
cpu00F4A_plat5C_ver00000004_2005-12-14_PRD_5E7996D9.bin tscdiff=00000000002424F7
cpu00F4A_plat5D_ver00000002_2005-06-10_PRD_DFBC9997.bin tscdiff=000000000023095F
cpu00F60_plat07_ver00000005_2005-01-24_PRD_A42FB999.bin tscdiff=00000000001154A6
cpu00F61_plat01_ver00000008_2005-06-10_PRD_FBB38F28.bin tscdiff=000000000038C0C4
cpu00F61_plat04_ver00000007_2005-06-10_PRD_AB7DD242.bin tscdiff=00000000006184EC
cpu00F62_plat01_ver00000005_2005-07-20_PRD_7445C8D2.bin tscdiff=00000000001154C2
cpu00F62_plat04_ver0000000F_2005-12-15_PRD_0976D137.bin len=00000C00 tscdiff=00000000001154E9
cpu00F63_plat01_ver00000005_2005-10-10_PRD_583AC51B.bin tscdiff=000000000047EABD
cpu00F64_plat01_ver00000002_2005-12-15_PRD_680B0995.bin len=00000C00 tscdiff=00000000001154DF
cpu00F64_plat34_ver00000004_2005-12-23_PRD_C66DBF02.bin len=00000C00 tscdiff=00000000001154CC
cpu00F65_plat04_ver00000009_2006-04-28_PRD_1262A7E1.bin tscdiff=0000000000354BDB
cpu00F65_plat04_ver0000000B_2007-05-10_PRD_69B15BBA.bin tscdiff=0000000000354D60
cpu00F66_plat02_ver0000001B_2006-03-10_PRD_19D845D7.bin len=00000C00 tscdiff=00000000004935DE
cpu00F68_plat22_ver00000008_2006-05-16_PRD_66638E22.bin tscdiff=0000000000382115
cpu00F68_plat22_ver00000009_2006-07-14_PRD_0D8BB650.bin tscdiff=000000000038F520

F29/plat04

Lines marked "OK" result in successfully loaded patch (another revision was loaded before loading modified patchfile to verify load status).

Timing for successful load ranges from 00000000000CD4C4 to 00000000000CD4DC; Unsuccessful has range from 00000000000CD4A8 to 00000000000CD55C which makes rdtsc measurement not feasible for this task.

0030.0 OK
0030.1
0030.2
0030.3
0030.4
0030.5
0030.6
0030.7

0031.0 OK
0031.1 OK
0031.2 OK
0031.3
0031.4
0031.5
0031.6 OK
0031.7

0032.0
0032.1 OK
0032.2 OK
0032.3
0032.4 OK
0032.5 OK
0032.6 OK
0032.7 OK

0033.0 OK
0033.1 OK
0033.2
0033.3 OK
0033.4 OK
0033.5
0033.6 OK
0033.7 OK

0034.0
0034.1 OK
0034.2 OK
0034.3
0034.4
0034.5
0034.6 OK
0034.7

0035.0
0035.1 OK
0035.2 OK
0035.3 OK
0035.4 OK
0035.5
0035.6 OK
0035.7 OK

0036.0 OK
0036.1
0036.2 OK
0036.3
0036.4
0036.5
0036.6 OK
0036.7
0037.0 OK
0037.1 OK
0037.2
0037.3
0037.4
0037.5 OK
0037.6
0037.7 OK

Probably any change from byte 38 to 7EA results in load failure (tested on 38 to 29C, then from 780 to 7FF). At the end of file:

07EA.0
07EA.1
07EA.2
07EA.3
07EA.4 OK
07EA.5 OK
07EA.6
07EA.7
07EB.0
07EB.1
07EB.2
07EB.3
07EB.4
07EB.5
07EB.6
07EB.7
07EC.0
07EC.1
07EC.2
07EC.3
07EC.4
07EC.5
07EC.6
07EC.7
07ED.0
07ED.1
07ED.2
07ED.3
07ED.4
07ED.5
07ED.6
07ED.7
07EE.0
07EE.1
07EE.2
07EE.3
07EE.4
07EE.5
07EE.6
07EE.7
07EF.0
07EF.1
07EF.2
07EF.3
07EF.4
07EF.5
07EF.6
07EF.7
07F0.0
07F0.1
07F0.2
07F0.3
07F0.4
07F0.5
07F0.6
07F0.7
07F1.0
07F1.1
07F1.2
07F1.3
07F1.4
07F1.5
07F1.6
07F1.7
07F2.0
07F2.1
07F2.2
07F2.3
07F2.4
07F2.5
07F2.6
07F2.7
07F3.0
07F3.1
07F3.2
07F3.3
07F3.4
07F3.5 OK
07F3.6 OK
07F3.7 OK
07F4.0 OK
07F4.1 OK
07F4.2 OK
07F4.3
07F4.4
07F4.5
07F4.6
07F4.7
07F5.0
07F5.1
07F5.2
07F5.3
07F5.4
07F5.5
07F5.6
07F5.7
07F6.0
07F6.1
07F6.2
07F6.3
07F6.4
07F6.5
07F6.6
07F6.7
07F7.0
07F7.1
07F7.2
07F7.3
07F7.4
07F7.5
07F7.6
07F7.7
07F8.0 OK
07F8.1 OK
07F8.2 OK
07F8.3 OK
07F8.4 OK
07F8.5 OK
07F8.6 OK
07F8.7 OK
07F9.0 OK
07F9.1 OK
07F9.2 OK
07F9.3 OK
07F9.4 OK
07F9.5 OK
07F9.6 OK
07F9.7 OK
07FA.0 OK
07FA.1 OK
07FA.2 OK
07FA.3 OK
07FA.4 OK
07FA.5 OK
07FA.6 OK
07FA.7 OK
07FB.0 OK
07FB.1 OK
07FB.2 OK
07FB.3 OK
07FB.4 OK
07FB.5 OK
07FB.6 OK
07FB.7 OK

07FC.0   -- this might possibly be checksum!
07FC.1
07FC.2
07FC.3
07FC.4
07FC.5
07FC.6
07FC.7
07FD.0
07FD.1
07FD.2
07FD.3
07FD.4
07FD.5
07FD.6
07FD.7
07FE.0
07FE.1
07FE.2
07FE.3
07FE.4
07FE.5
07FE.6
07FE.7
07FF.0
07FF.1
07FF.2
07FF.3
07FF.4
07FF.5
07FF.6
07FF.7

x86_notamd64

• soc.me/interfaces/intels-original-64bit-extensions-for-x86.html↗
• quora.com/.../How-was-AMD-able-to-beat-Intel-in-delivering-the-first-x86-64-i...↗
• US6625724B1 Method and apparatus to support an expanded register set
• US7363476B2 Method and apparatus to support an expanded register set

Hardware

• theretroweb.com/misc/documentation/24919805-65c61fe6ad504963553671.pdf↗ (Socket 423)
• download.intel.com/design/Pentium4/guides/24989002.pdf↗ (Socket 478)
• theretroweb.com/misc/documentation/24988703-65c62100b3cbc022696527.pdf↗ (Socket 478)
• www.intel.com/Assets/PDF/datasheet/306382.pdf↗ (LGA775)

Socket 423 JTAG pins

• TMS D38
• TDI J39
• TDO P36
• TCK R37
• TRST# A35
• TRDY# R35

Socket 478 JTAG pins

• TMS F7
• TDI D5
• TDO C1
• TCK D4
• TRST# E6

LGA775 JTAG pins

• TMS AC1
• TDI AD1
• TDO AF1
• TCK AE1
• TRST# AG1

---

The author is not affiliated with, endorsed by, or sponsored by Intel Corporation or its affiliates. All trademarks, including but not limited to Intel, Pentium, and any other registered or unregistered marks mentioned herein, are the property of their respective owners. Their use in this context is solely for descriptive and informational purposes and constitutes nominative fair use under applicable trademark laws.